Skip to content

feat: Add debug logging option for OPA responses#13142

Open
vdegans wants to merge 2 commits intoapache:masterfrom
vdegans:master
Open

feat: Add debug logging option for OPA responses#13142
vdegans wants to merge 2 commits intoapache:masterfrom
vdegans:master

Conversation

@vdegans
Copy link
Copy Markdown

@vdegans vdegans commented Apr 1, 2026

Description

This PR introduces an optional debug logging configuration for Open Policy Agent (OPA) responses to improve observability during development and troubleshooting.


Changes

  • Added a new configuration field:

    debug = {
        type = "boolean",
        default = false,
        description = "enable debug logging of OPA responses (only for local development)"
    }
  • When debug is enabled:

    • Logs the raw OPA response, including HTTP status and body.
    • Logs the evaluated decision result (allow) along with the full decoded response payload.
  • Logging is performed using core.log.debug, ensuring no impact on production environments unless explicitly enabled.


Motivation

OPA policy evaluation can be difficult to debug due to limited visibility into the responses returned by the OPA server. This change provides developers with detailed insights into:

  • The raw response returned by OPA
  • The parsed decision output used by APISIX

This significantly improves the ability to diagnose misconfigurations, policy errors, or unexpected authorization behavior during local development.


Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

@dosubot dosubot bot added size:M This PR changes 30-99 lines, ignoring generated files. enhancement New feature or request labels Apr 1, 2026
@vdegans vdegans changed the title Add debug logging option for OPA responses feat: Add debug logging option for OPA responses Apr 1, 2026
@vdegans vdegans changed the title feat: Add debug logging option for OPA responses feat: Add debug logging option for OPA responses Apr 1, 2026
with_route = {type = "boolean", default = false},
with_service = {type = "boolean", default = false},
with_consumer = {type = "boolean", default = false},
debug = {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this configuration option is necessary. When the log level is set to debug, debug logs will already be printed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request size:M This PR changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants